Chapter 2. Projects

Procedure

1. Navigate to Home Projects.
2. Click Create Project.
3. Enter your project details.
4. Click Create.

1. Click the Project drop-down menu to see a list of all available projects. Select Create Project.

   Figure 2.1. Create project

   
2. In the Create Project dialog box, enter a unique name, such as

   myproject

   , in the Name field.
3. Optional: Add the Display Name and Description details for the project.
4. Click Create.
5. Use the left navigation panel to navigate to the Project view and see the dashboard for your project.

6. Optional:

   • Use the Project drop-down menu at the top of the screen and select all projects to list all of the projects in your cluster.
   • Use the Details tab to see the project details.
   • If you have adequate permissions for a project, you can use the Project Access tab to provide or revoke administrator, edit, and view privileges for the project.

Procedure

1. Navigate to Home Projects.

2. Select a project to view.

   On this page, click Workloads to see workloads in the project.

Procedure

1. To view a list of projects, run:

   $ oc get projects

2. You can change from the current project to a different project for CLI operations. The specified project is then used in all subsequent operations that manipulate project-scoped content:

   $ oc project <project_name>

1. In the Developer perspective, navigate to the Project view.
2. In the Project page, select the Project Access tab.

3. Click Add Access to add a new row of permissions to the default ones.

   Figure 2.2. Project permissions

   
4. Enter the user name, click the Select a role drop-down list, and select an appropriate role.
5. Click Save to add the new permissions.

1. In the Search view, use the Resources drop-down list to search for

   Console

   .

2. From the available options, select the Console operator.openshift.io/v1.

   Figure 2.3. Searching Console resource

   
3. Select cluster under the Name list.
4. Navigate to the YAML tab to view and edit the YAML code.

5. In the YAML code under

   spec

   , add or edit the list of

   availableClusterRoles

   and save your changes:

   spec:
     customization:
       projectAccess:
         availableClusterRoles:
         - admin
         - edit
         - view

Procedure

1. Select Developer from the context selector at the top of the web console navigation menu.
2. Click +Add
3. At the top of the page, select the name of the project that you want to add to.
4. Click a method for adding to your project, and then follow the workflow.

Procedure

1. Navigate to Home Projects.
2. Select a project to see its status.

Procedure

1. Run:

   $ oc status

   This command provides a high-level overview of the current project, with its components and their relationships.

Procedure

1. Navigate to Home Projects.
2. Locate the project that you want to delete from the list of projects.
3. On the far right side of the project listing, select Delete Project from the Options menu .
4. When the Delete Project pane opens, enter the name of the project that you want to delete in the field.
5. Click Delete.

Procedure

1. Run:

   $ oc delete project <project_name>

Procedure

1. Log in as a user with

   cluster-admin

   privileges.

2. Generate the default project template:

   $ oc adm create-bootstrap-project-template -o yaml > template.yaml

3. Use a text editor to modify the generated

   template.yaml

   file by adding objects or modifying existing objects.

4. The project template must be created in the

   openshift-config

   namespace. Load your modified template:

   $ oc create -f template.yaml -n openshift-config

5. Edit the project configuration resource using the web console or CLI.

   • Using the web console:

     1. Navigate to the Administration Cluster Settings page.
     2. Click Configuration to view all configuration resources.
     3. Find the entry for Project and click Edit YAML.

   • Using the CLI:

     1. Edit the

        project.config.openshift.io/cluster

        resource:

        $ oc edit project.config.openshift.io/cluster

6. Update the

   spec

   section to include the

   projectRequestTemplate

   and

   name

   parameters, and set the name of your uploaded project template. The default name is

   project-request

   .

   Project configuration resource with custom project template

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
     ...
   spec:
     projectRequestTemplate:
       name: <template_name>

7. After you save your changes, create a new project to verify that your changes were successfully applied.

Procedure

1. Log in as a user with

   cluster-admin

   privileges.

2. View the

   self-provisioners

   cluster role binding usage by running the following command:

   $ oc describe clusterrolebinding.rbac self-provisioners

   Example output

   Name:		self-provisioners
   Labels:		<none>
   Annotations:	rbac.authorization.kubernetes.io/autoupdate=true
   Role:
     Kind:	ClusterRole
     Name:	self-provisioner
   Subjects:
     Kind	Name				Namespace
     ----	----				---------
     Group	system:authenticated:oauth

   Review the subjects in the

   self-provisioners

   section.

3. Remove the

   self-provisioner

   cluster role from the group

   system:authenticated:oauth

   .

   • If the

     self-provisioners

     cluster role binding binds only the

     self-provisioner

     role to the

     system:authenticated:oauth

     group, run the following command:

     $ oc patch clusterrolebinding.rbac self-provisioners -p '{"subjects": null}'

   • If the

     self-provisioners

     cluster role binding binds the

     self-provisioner

     role to more users, groups, or service accounts than the

     system:authenticated:oauth

     group, run the following command:

     $ oc adm policy \
         remove-cluster-role-from-group self-provisioner \
         system:authenticated:oauth

4. Edit the

   self-provisioners

   cluster role binding to prevent automatic updates to the role. Automatic updates reset the cluster roles to the default state.

   • To update the role binding using the CLI:

     1. Run the following command:

        $ oc edit clusterrolebinding.rbac self-provisioners

     2. In the displayed role binding, set the

        rbac.authorization.kubernetes.io/autoupdate

        parameter value to

        false

        , as shown in the following example:

        apiVersion: authorization.openshift.io/v1
        kind: ClusterRoleBinding
        metadata:
          annotations:
            rbac.authorization.kubernetes.io/autoupdate: "false"
          ...

   • To update the role binding by using a single command:

     $ oc patch clusterrolebinding.rbac self-provisioners -p '{ "metadata": { "annotations": { "rbac.authorization.kubernetes.io/autoupdate": "false" } } }'

5. Log in as an authenticated user and verify that it can no longer self-provision a project:

   $ oc new-project test

   Example output

   Error from server (Forbidden): You may not request a new project via this API.

   Consider customizing this project request message to provide more helpful instructions specific to your organization.

Procedure

1. Edit the project configuration resource using the web console or CLI.

   • Using the web console:

     1. Navigate to the Administration Cluster Settings page.
     2. Click Configuration to view all configuration resources.
     3. Find the entry for Project and click Edit YAML.

   • Using the CLI:

     1. Log in as a user with

        cluster-admin

        privileges.

     2. Edit the

        project.config.openshift.io/cluster

        resource:

        $ oc edit project.config.openshift.io/cluster

2. Update the

   spec

   section to include the

   projectRequestMessage

   parameter and set the value to your custom message:

   Project configuration resource with custom project request message

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
     ...
   spec:
     projectRequestMessage: <message_string>

   For example:

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
     ...
   spec:
     projectRequestMessage: To request a project, contact your system administrator at projectname@example.com.

3. After you save your changes, attempt to create a new project as a developer or service account that is unable to self-provision projects to verify that your changes were successfully applied.